Linux Kernel up to 6.17.3 lan78xx.c lan78xx_read_raw_eeprom uninitialized pointer

Summaryinfo

A vulnerability categorized as critical has been discovered in Linux Kernel up to 6.17.3. This impacts the function lan78xx_read_raw_eeprom of the file drivers/net/usb/lan78xx.c. Executing a manipulation can lead to uninitialized pointer. This vulnerability is tracked as CVE-2025-40189. No exploit exists. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in Linux Kernel up to 6.17.3. It has been declared as critical. This vulnerability affects the function lan78xx_read_raw_eeprom of the file drivers/net/usb/lan78xx.c. The manipulation with an unknown input leads to a uninitialized pointer vulnerability. The CWE definition for the vulnerability is CWE-824. The product accesses or uses a pointer that has not been initialized. The impact remains unknown. CVE summarizes:

In the Linux kernel, the following vulnerability has been resolved: net: usb: lan78xx: Fix lost EEPROM read timeout error(-ETIMEDOUT) in lan78xx_read_raw_eeprom Syzbot reported read of uninitialized variable BUG with following call stack. lan78xx 8-1:1.0 (unnamed net_device) (uninitialized): EEPROM read operation timeout ===================================================== BUG: KMSAN: uninit-value in lan78xx_read_eeprom drivers/net/usb/lan78xx.c:1095 [inline] BUG: KMSAN: uninit-value in lan78xx_init_mac_address drivers/net/usb/lan78xx.c:1937 [inline] BUG: KMSAN: uninit-value in lan78xx_reset+0x999/0x2cd0 drivers/net/usb/lan78xx.c:3241 lan78xx_read_eeprom drivers/net/usb/lan78xx.c:1095 [inline] lan78xx_init_mac_address drivers/net/usb/lan78xx.c:1937 [inline] lan78xx_reset+0x999/0x2cd0 drivers/net/usb/lan78xx.c:3241 lan78xx_bind+0x711/0x1690 drivers/net/usb/lan78xx.c:3766 lan78xx_probe+0x225c/0x3310 drivers/net/usb/lan78xx.c:4707 Local variable sig.i.i created at: lan78xx_read_eeprom drivers/net/usb/lan78xx.c:1092 [inline] lan78xx_init_mac_address drivers/net/usb/lan78xx.c:1937 [inline] lan78xx_reset+0x77e/0x2cd0 drivers/net/usb/lan78xx.c:3241 lan78xx_bind+0x711/0x1690 drivers/net/usb/lan78xx.c:3766 The function lan78xx_read_raw_eeprom failed to properly propagate EEPROM read timeout errors (-ETIMEDOUT). In the fallthrough path, it first attempted to restore the pin configuration for LED outputs and then returned only the status of that restore operation, discarding the original timeout error. As a result, callers could mistakenly treat the data buffer as valid even though the EEPROM read had actually timed out with no data or partial data. To fix this, handle errors in restoring the LED pin configuration separately. If the restore succeeds, return any prior EEPROM timeout error correctly to the caller.

The advisory is available at git.kernel.org. This vulnerability was named CVE-2025-40189 since 04/16/2025. The exploitation appears to be easy. Technical details are known, but there is no available exploit. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 02/07/2026).

The vulnerability scanner Nessus provides a plugin with the ID 275348 (Linux Distros Unpatched Vulnerability : CVE-2025-40189), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 6.17.4 or 6.18-rc1 eliminates this vulnerability. Applying the patch a72a7c4f675080a324d4c2167bd2314d968279f1/49bdb63ff64469a6de8ea901aef123c75be9bbe7 is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the databases at Tenable (275348) and CERT Bund (WID-SEC-2025-2595). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Affected

• Google Container-Optimized OS
• Debian Linux
• Amazon Linux 2
• Red Hat Enterprise Linux
• SUSE Linux
• Oracle Linux
• SUSE openSUSE
• Open Source Linux Kernel
• RESF Rocky Linux

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 6.17.0
• 6.17.1
• 6.17.2
• 6.17.3

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion